Read the current Lumion RFC sources in lumions-rfc/src/:

• draft-shearer-lumion-00.md
• draft-shearer-lumion-encoding-00.md

Create a small educational Python demo implementation in lumions-rfc/demo/lumion_demo.py, plus a matching lumions-rfc/demo/README.md.

The Python demo may use the cryptography package for Ed25519 and ChaCha20-Poly1305; document that dependency in the README.

Implement the Lumion features currently specified by those RFCs. Keep the code deliberately small and readable.

Demo scenario: Alice's employee record:

• message = "signed row"
• name = "Alice"
• department = "research"
• salary = "100000" initially, then "110000" in an update
• employee_id = "E123"
• private_note = "private note"

Use the scenario to build a ladder of example Lumions with increasing capability:

• signed row
• named row
• versioned row using a prior link
• redactable row where salary is removed
• confidential row where private_note is encrypted
• access-rules row where salary has permitted writers and employee_id is immutable

Use these output filename stems for the ladder:

• 01-signed-row
• 02-named-row
• 03-versioned-row
• 04-redactable-full and 04-redactable-without-salary
• 05-confidential-row
• 06-access-rules-v0 and 06-access-rules-v1

The CLI should provide these commands:

• selftest
• signed
• named
• versioned
• redactable
• confidential
• access
• ladder
• inspect

The ladder command should write binary .lumion files and unpadded base64url .b64url files under demo/out.

Use a deterministic demo signing key so examples are easy to inspect. Use fresh salts and encryption nonces by default.

Also provide a deterministic test mode, such as --seed. With the same seed, salts, nonces, generated content keys, and output bytes must match.

Add an --asciiart option that prints a readable structural view of a generated or inspected Lumion: header, name, signer, version/prior link, part-hash root, signature, and part summaries.

The README should describe only implemented RFC features. Do not describe append-only provenance or other authority-layer features.

The selftest command should verify successful verification, redaction preserving name and signature, a valid writer update, rejection of an invalid writer update, rejection of an access-rule change, and byte-identical seeded output.